Risk Response and Reporting · Topic 1 of 9
Risk Response Options and Risk and Control Ownership
CRISC risk response: accept, mitigate, transfer or share, and avoid, how to choose between them, and how to assign and validate risk and control ownership.
- 5 min
- Includes a diagram
- The four responses are accept, mitigate, transfer or share, and avoid.
- Transfer moves financial impact, never accountability.
- Acceptance must be explicit, documented, within authority and reviewed.
What it is
A risk response is the decision about what to do with a risk once it has been assessed. ISACA uses four options: accept, mitigate, transfer or share, and avoid. The goal is to bring residual risk within appetite at a cost that makes business sense.
Ownership makes the response happen: the risk owner chooses the response and accepts what remains. The control owner makes sure each control works. The practitioner assigns ownership with management and validates that owners understand and accept their role.
How it works
The four response options
| Option | What it means | Example |
|---|---|---|
| Accept | Take the risk as it is, knowingly and within authority | Accept minor downtime risk on an internal wiki |
| Mitigate | Reduce likelihood or impact with controls | Add MFA and monitoring to remote access |
| Transfer or share | Move part of the financial impact to another party | Cyber insurance, outsourcing contract with liability clauses |
| Avoid | Stop or change the activity that creates the risk | Decide not to launch a service in a high-risk market |
Transfer moves financial consequences, not accountability. If a cloud provider loses customer data, the organization is still accountable to its customers and regulators. Insurance pays some costs but does not restore reputation.
Acceptance must be explicit and documented, made by someone with the authority to accept that level of risk, and reviewed periodically. Risk that is ignored is not accepted; it is simply unmanaged.
For opportunities, the equivalent responses are to exploit, enhance, share or accept them. Risk IT treats missing a beneficial opportunity as a risk too.
Choosing a response
| Factor | Question |
|---|---|
| Appetite and tolerance | Does residual risk fit after the response? |
| Cost and benefit | Does the reduction in risk justify the cost? |
| Capability | Can the organization implement and run the response? |
| Obligations | Do laws or contracts require a particular control? |
| Side effects | Does the response create new risks or affect other risks? |
| Timing | How soon is the response needed? |
The practitioner analyses options and recommends. The risk owner chooses, because the risk owner bears the business consequences and controls the budget.
Assigning risk ownership
A good risk owner has the authority, budget and business accountability to act. That is usually a senior business manager for the process at risk. Ownership should be at a level able to accept the risk under the escalation rules.
Validation matters. The practitioner confirms the owner knows they own the risk, agrees with the rating, and has acted. Ownership recorded in a register but unknown to the named person does not count.
Control ownership
The control owner is accountable for a control's design, operation and maintenance. A control owner may be in IT, security or the business. One risk can depend on many controls with different owners, and one control can reduce many risks.
| Role | Decides | Does |
|---|---|---|
| Risk owner | Response and acceptance | Funds and oversees treatment |
| Control owner | How the control works | Operates, maintains and evidences the control |
| Risk practitioner | Nothing on behalf of the business | Analyses, recommends, monitors, reports |
A worked example
A hospital's risk register shows that outdated infusion pump software creates patient safety risk above appetite. The practitioner analyses options: replacing the pumps (mitigate, high cost), isolating them on a separate network segment (mitigate, lower cost), insurance (transfer, which would not reduce harm to patients) or withdrawing them (avoid, not possible clinically).
The practitioner recommends network isolation now and replacement in the next budget year. The clinical director, as risk owner, approves and signs acceptance of the remaining risk until replacement. The network manager becomes control owner for the isolation control.
How the exam asks about this
- "Who should decide how to respond to a risk?" The risk owner, after analysis and recommendations from the practitioner.
- "Which response is MOST appropriate when the cost of controls exceeds the potential loss?" Acceptance, within appetite and by an authorized owner, or another lower-cost option.
- "An organization buys cyber insurance. What has it done?" Transferred part of the financial impact; accountability remains with the organization.
What to remember for the exam
- The four responses are accept, mitigate, transfer or share, and avoid.
- Transfer moves financial impact, never accountability.
- Acceptance must be explicit, documented, within authority and reviewed.
- The risk owner chooses the response; the control owner runs the control; the practitioner advises.
- Ownership must be validated, not just written in the register.
An option where the risk practitioner, IT or internal audit accepts risk for the business is almost always wrong. Acceptance belongs to the risk owner with the right authority.
Common mistakes
Thinking insurance removes the risk. It shifts some cost; reputational, legal and operational impacts remain.
Treating ignored risk as accepted. Acceptance is a documented decision, not a lack of action.
Making the control owner the risk owner by default. The person running a firewall rarely owns the business risk it reduces.
Check yourself
What does transferring a risk actually move?
Part of the financial consequence, such as through insurance or contracts; accountability for the risk stays with the organization.
What makes a good risk owner?
A manager with the authority, budget and business accountability to decide on and fund the response.
Why must the practitioner validate risk ownership?
Because named owners must know, agree with and act on their responsibility, otherwise the risk is effectively unowned.
Topic 1 of 9 in Risk Response and Reporting
Test yourself on Risk Response and Reporting
The full ISACA CRISC question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.